By “paper backup” I mean what is commonly associated with it:
- To be able to print out the private keys of a wallet, in both human readable and computer readable format
- To include the public keys in human readable and computer readable format, so you can quickly check whether the paper still holds value.
- To be able to import the backup easily.
By “multi” I mean something similar to “encrypted” or “N-factor authentication”:
- The backup should consist of multiple sheets. It should only be possible to spend the Bitcoins if you have ALL of the sheets. This allows you to keep the backup safe from physical theft by splitting it to different locations.
- Ideally, the amount of sheets should be freely configurable.
- It can be implemented by having a long password for the wallet which is split into equal-sized parts and each sheet containing only one part. This allows the user to destroy one sheet and instead memorize the password which was on it. Then you effectively have an encrypted paper backup as a bonus feature.
By “nested” I mean something to provide plausible deniability:
- It would be useful to not disclose the number of sheets on each sheet. Then an attacker cannot quickly tell whether he has all of them, and might quit searching for more.
- To prevent the attacker from being able to determine whether he has all sheets, make each sheet represent a complete Bitcoin address, including private key. Fund that address with a decoy amount of Bitcoins.
- Put the random seed used to generate the decoy address on each sheet. But also generate a “primary” Bitcoin address whose public/private keys are NOT mentioned on the sheets.
- Instead, the primary key is generated by concatenating the random seeds used for generating the decoy addresses of all sheets. Put 90% of the money into the primary address.
- So ALL of the sheets combined would generate the “actual” address which holds the most amount of coins. But the attacker would stop trying to search more sheets once he has found one, because it DOES hold money. Just not all of it.
- This could even be raised to a higher level: For each possible N out of M combinations of the sheets, also generate a decoy primary address which holds a little amount of Bitcoins. If the attacker believes that you had used the nesting feature and harasses you to hand out the remaining sheets, you can plausibly claim having given all of them to him, while you only revealed part of the whole.
Even if the nesting is not implemented at first, I think at least the multi-sheet part is absolutely critical. One of the core advantages of Bitcoin surely is that they cannot be physically stolen because you can encrypt them. This is voided with physical paper backup which isn’t split into multiple sheets.
You might argue that paper backup doesn’t have to be implemented in Bitcoin-Qt because Bitcoin-Armory already supports it somehow. I think backup really should be a core feature of the reference Bitcoin client because it is a core advantage of Bitcoin. You cannot backup dollars. You can backup Bitcoins.
Please make the reference Bitcoin client more useful for the very paranoid.
[Off-topic PS: I’m greedy and proud of the nesting idea, make me happy: 14EpAnasbwpeRH55mQZKX8GjZRnY6DCNsQ :) Admins please mail me if donation requests are not allowed, I will remove it then.]
